The vulnerability CVE-2025-30587 affects the shawfactor LH OGP Meta plugin, allowing a CSRF attack that results in Stored XSS. This means an attacker can trick an authenticated user into submitting a request that stores malicious script code, which can then be executed in the context of other users. The affected versions are up to 1.73. The CVSS score of 7.1 indicates a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability can lead to stored cross-site scripting, which may allow attackers to execute arbitrary scripts in the context of users interacting with the affected plugin. This can compromise confidentiality, integrity, and availability of the affected system. Since the attack requires user interaction and no privileges, it can be leveraged remotely over the network. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version if feasible. Additionally, applying web application firewalls or other CSRF protections may help mitigate risk, but these are not guaranteed to fully prevent exploitation.